Classifier anomalies for observed behaviors in a video surveillance system

ABSTRACT

Techniques are disclosed for a video surveillance system to learn to recognize complex behaviors by analyzing pixel data using alternating layers of clustering and sequencing. A combination of a self organizing map (SOM) and an adaptive resonance theory (ART) network may be used to identify a variety of different anomalous inputs at each cluster layer. As progressively higher layers of the cortex model component represent progressively higher levels of abstraction, anomalies occurring in the higher levels of the cortex model represent observations of behavioral anomalies corresponding to progressively complex patterns of behavior.

BACKGROUND OF THE INVENTION

1. Field of the Invention

Embodiments of the invention provide techniques for analyzing a sequenceof video frames. More specifically, embodiments of the invention providea video surveillance system configured to learn to recognize complexbehaviors by analyzing pixel data using alternating layers of clusteringand sequencing. Such a system may learn, over time, to identifyanomalous behaviors at progressively more complex levels of abstraction.

2. Description of the Related Art

Some currently available video surveillance systems provide simpleobject recognition capabilities. For example, a video surveillancesystem may be configured to distinguish between scene foreground (activeelements) and scene background (static elements) depicted in a videostream. A group of pixels (referred to as a “blob”) depicting sceneforeground may be identified as an active agent in the scene. Onceidentified, a “blob” may be tracked from frame-to-frame, allowing thesystem to follow and observe the “blob” moving through the scene overtime, e.g., a set of pixels depicting a person walking across the fieldof vision of a video surveillance camera may be identified and trackedfrom frame-to-frame.

Some such systems may also classify a blob as being a particular agent(e.g., a person or a vehicle) as well as determine when an object hasengaged in certain predefined behaviors. For example, a system may beable to identify certain simple events: “vehicle stopped,” or “personenters vehicle,” etc. The analysis typically includes tracking anobject, assigning an object type, and analyzing its position, direction,and velocity, etc., to recognize simple events such as stop, turn,start, etc. A limiting factor for these systems is that the objects andactions involved need to belong to a known, small set of types. Thesystems involved are usually trained on a set of examples and cannotrecognize new behavior types when brought on-line. The actions or eventsare usually directly derived from the data of the tracked object. As aresult, such systems have been unable to recognize higher-orders ofbehavior from the observations of basic or simple actions.

Some currently available systems employ statistical models such asMarkov systems or Bayesian networks to analyze a scene depicted in asequence of video frames. However, these systems have proven to be tooslow for real-time use and/or require extensive hand design andparameter tuning. Thus, such systems must be carefully calibrated for agiven scene, and as the scene changes, or as new or different behaviorsevolve, the system needs be recalibrated. Further, given theselimitations, current systems are unable to recognize unusual orunexpected behaviors; to work in a wide variety of real-life situations;or to adapt to a changing environment.

In other words, current video analysis systems rely on predefinedobjects and/or behaviors to evaluate a video sequence. And unless theunderlying system includes a description for a particular object orbehavior, the system is generally incapable of recognizing that behavior(via instances of the pattern describing the particular object orbehavior). Thus, what is “normal” or “anomalous” is defined in advanceand additional knowledge engineering or additional software products arerequired to recognize additional objects or behaviors. This results invideo surveillance systems with recognition capabilities that are laborintensive and prohibitively costly to maintain or adapt for differentspecialized applications.

SUMMARY

Embodiments of the invention relate to techniques for analyzing a scenecaptured by a video camera or other recorded video. One embodimentprovides a method for analyzing a sequence of video frames depicting ascene captured by a video camera. The method may generally includereceiving a set of data inputs derived by a computer vision engineconfigured to analyze pixels depicting a plurality of foreground objectsin the sequence of video frames and modeling behavior of the foregroundobjects in the scene by passing the received sensory data inputs to afirst cluster layer of a plurality of layers. The plurality of layersalternate between cluster layers and sequence layers. And the clusterlayers generate clusters of sequences and the sequence layers generatesequences of clusters. The method may further include evaluating one ormore of the cluster layers to identify an occurrence of a behavioralanomaly based on an input to one of the cluster layers and publishing analert message indicating the occurrence of the behavioral anomaly.

Another embodiment of the invention includes a computer-readable storagemedium containing a program which, when executed by a processor,performs an operation for analyzing a sequence of video frames depictinga scene captured by a video camera. The operation itself may generallyinclude receiving a set of data inputs derived by a computer visionengine configured to analyze pixels depicting a plurality of foregroundobjects in the sequence of video frames and modeling behavior of theforeground objects in the scene by passing the received sensory datainputs to a first cluster layer of a plurality of layers. The pluralityof layers alternate between cluster layers and sequence layers. And thecluster layers generate clusters of sequences and the sequence layersgenerate sequences of clusters. The operation may further includeevaluating one or more of the cluster layers to identify an occurrenceof a behavioral anomaly based on an input to one of the cluster layersand publishing an alert message indicating the occurrence of thebehavioral anomaly.

Still another embodiment of the invention includes a system having avideo input source configured to provide a sequence of video frames,each depicting a scene, a processor, and a memory containing a program.The program, when executed on the processor, may be configured toperform an operation for analyzing the scene, as depicted by thesequence of video frames captured by the video input source. Theoperation itself may generally include receiving a set of data inputsderived by a computer vision engine configured to analyze pixelsdepicting a plurality of foreground objects in the sequence of videoframes and modeling behavior of the foreground objects in the scene bypassing the received sensory data inputs to a first cluster layer of aplurality of layers. The plurality of layers alternate between clusterlayers and sequence layers. And the cluster layers generate clusters ofsequences and the sequence layers generate sequences of clusters. Theoperation may further include evaluating one or more of the clusterlayers to identify an occurrence of a behavioral anomaly based on aninput to one of the cluster layers and publishing an alert messageindicating the occurrence of the behavioral anomaly.

BRIEF DESCRIPTION OF THE DRAWINGS

So that the manner in which the above recited features, advantages, andobjects of the present invention are attained and can be understood indetail, a more particular description of the invention, brieflysummarized above, may be had by reference to the embodiments illustratedin the appended drawings.

It is to be noted, however, that the appended drawings illustrate onlytypical embodiments of this invention and are therefore not to beconsidered limiting of its scope, for the invention may admit to otherequally effective embodiments.

FIG. 1 illustrates components of a video surveillance system, accordingto one embodiment of the invention.

FIG. 2 further illustrates components of the video surveillance systemshown in FIG. 1, according to one embodiment of the invention.

FIG. 3 further illustrates a cortex model component first shown in FIG.2, according to one embodiment of the invention.

FIG. 4 illustrates a method for the cortex model component of FIG. 2 toevaluate a sequence of video frames using alternating cluster andsequence layers, according to one embodiment of the invention.

FIG. 5 illustrates sensory data passed to a first cluster layer of thecortex model component of FIG. 2, according to one embodiment of theinvention.

FIG. 6 illustrates a data flow for training a cluster layer in thecortex model component of FIG. 2, according to one embodiment of theinvention.

FIG. 7 illustrates a cluster layer and a sequence layer of the cortexmodel component of FIG. 2, according to one embodiment of the invention.

FIG. 8 illustrates a method for training a self-organizing map (SOM) andan adaptive resonance theory (ART) network in a cluster layer of thecortex model component of FIG. 2, according to one embodiment of theinvention.

FIG. 9 illustrates a method for the cortex model component of FIG. 2 tomodel progressively more complex levels of behavior, according to oneembodiment of the invention

FIG. 10 illustrates a method for the cortex model component of FIG. 2 toidentify occurrences of unusual behavior (anomalies) for progressivelymore complex levels of behavior based on prior observations of a scene,according to one embodiment of the invention.

DETAILED DESCRIPTION

Embodiments of the invention relate to techniques for analyzing a scenecaptured by sensors or other recorded sensor data. One embodimentprovides a computer-implemented method for analyzing video data. Thecomputer implementation models certain aspects of the mammalian cerebralcortex. The sensory cortices are quite similar except for the firstlayer, which receives data directly from the specific sense organ. Thelower layers of the cortex contain two sections, a dorsal section whichdetermines what is being seen a ventral section which determineslocation and motion. The sensory data may be represented as featurevectors which are formed into clusters. These clusters form sequences,then clusters of sequences of clusters of feature vectors are formed,etc. Each level becomes more abstract and involves a larger amount ofspace and time. One embodiment of the invention uses self-organizingmaps (SOMs) and adaptive resonance theory (ART) networks to formclusters, and the Voting Experts method to form sequences.

Thus, embodiments of the invention provide techniques for a videosurveillance system to learn to recognize complex behaviors by analyzingpixel data using alternating layers of clustering and sequencing. Oneembodiment includes a video surveillance system configured to observe ascene (as depicted in a sequence of video frames) and, over time,develop hierarchies of concepts including classes of objects, actionsand behaviors. That is, the video surveillance system may develop modelsat progressively more complex levels of abstraction used to identifywhat events and behaviors are common and which are unusual. When themodels have matured, the video surveillance system issues alerts onunusual events. This may occur automatically, without user input andusing any sensors that can track and classify objects.

In one embodiment, the video surveillance system may include a computervision engine configured to generate a background model representing thebackground elements of a scene. The background model generallyrepresents the static elements of a scene captured by a video camera.For example, consider a video camera trained on a stretch of highway. Insuch a case, the background would include the roadway surface, themedians, any guard rails or other safety devices, and traffic controldevices, etc., visible to the camera. The background model may includean expected pixel color value for each pixel of the scene when thebackground is visible to the camera. Thus, the background model providesa rough image of the scene in which no activity is occurring (e.g., anempty roadway). Conversely, vehicles traveling on the roadway (and anyother person or thing engaging in some activity) occlude the backgroundwhen visible to the camera and represent scene foreground objects.

Once the background model has matured, the computer vision engine maycompare the pixel values for subsequent frames with the background imageand identify objects as they appear and move about the scene. Typically,when a region of pixels in the scene (referred to as a “blob” or“patch”) is classified as depicting foreground, the patch itself isidentified as a foreground object. Once identified, the computer visionengine may derive a broad variety of kinematic data while tracking theforeground object from frame-to-frame, e.g., position, current (andprojected) direction, orientation, velocity, and acceleration of theobject, as well as other information such as size, color shininess,rigidity, height/width in pixels, average color values, shape, area,etc. In one embodiment, information derived by the computer visionengine may be used to track the object from frame-to-frame.

The computer vision engine may output this information as a stream of“context events” derived for each foreground object detected in thevideo frames. The context events may specify both the kinematic dataderived for a foreground object e.g., a spatial position, direction ofmovement, velocity and acceleration, etc. and data characterizing avariety of features of a foreground object, e.g., a shininess, rigidity,area, ratios of height to width, etc., (referred to herein asmicro-features). In one embodiment, the computer vision engine mayoutput the stream of context events related to each foreground objectobserved in the scene at a fixed rate (e.g., 5 Hz).

As described in greater detail herein, the context events (i.e., thekinematic data and the micro-feature data) output from the computervision engine may be supplied to the machine-learning engine. In oneembodiment, the machine learning engine includes a cortex modelcomponent configured to receive and analyze the context events outputfrom the computer vision engine. The context events provide the cortexmodel component with data that can describe foreground object behaviorfor any given scene captured by a video camera: object, time, position,velocity, and primitive features. Further, like a mammalian visualcortex, the lower layers of the cortex model component may be dividedinto two sections, one for object identification and one for objectlocation, referred to as the dorsal and ventral sections, respectively.The micro features are input to the first dorsal layer of the cortexmodel component and the kinematic data is input to the first ventrallayer of the cortex model component. At higher levels, outputs form thedorsal and ventral sides are combined so that an entire behavior-spacecan be represented.

In one embodiment, the cortex model component uses alternating layers ofclustering and sequencing to identify behaviors based on the numericaldata derived from a sequence of video frames (i.e., from the kinematicdata and micro features). In general, clusters in each cluster layerrepresent concepts and sequences in each sequence layer representlinguistic-like constructs or statements. Each layer of the cortex modelcomponent provides an additional degree of abstraction from theraw-sensor data (i.e., from the kinematic data and micro features).Thus, rather than attempt to identify complex patterns of behavior(whether normal or anomalous) from raw data directly, complex patternsof behavior may emerge in higher layers of the cortex model component.

In one embodiment, the cortex model component uses alternating layers ofclustering and sequencing to identify behaviors based on the numericaldata derived from video frames (i.e., from the kinematic data and/ormicro features). In general, clusters in each cluster layer andsequences in each sequence layer represent linguistic-like concepts,behaviors or statements. Each higher layer of the cortex model componentcontains information from a larger amount of space and time because ituses data from more frames. Each higher layer also provides anadditional degree of abstraction from the raw-sensor data (i.e., fromthe kinematic data and micro features). Thus, rather than attempt toidentify complex patterns of behavior (whether normal or anomalous) fromraw data directly, complex patterns of behavior emerge in higher layersof the cortex model component.

In addition to this bottom-up organization, which comes from sensorydata and dominates the process of cluster and sequence selection, thereis a top-down process, referred to as expectation maximization. Acluster may have a slight tendency to be assigned to the most likelysequence and a sequence will have a slight tendency to be assigned tothe most likely cluster. This helps resolve ambiguity and improvestability.

In the following, reference is made to embodiments of the invention.However, it should be understood that the invention is not limited toany specifically described embodiment. Instead, any combination of thefollowing features and elements, whether related to differentembodiments or not, is contemplated to implement and practice theinvention. Furthermore, in various embodiments the invention providesnumerous advantages over the prior art. However, although embodiments ofthe invention may achieve advantages over other possible solutionsand/or over the prior art, whether or not a particular advantage isachieved by a given embodiment is not limiting of the invention. Thus,the following aspects, features, embodiments and advantages are merelyillustrative and are not considered elements or limitations of theappended claims except where explicitly recited in a claim(s). Likewise,reference to “the invention” shall not be construed as a generalizationof any inventive subject matter disclosed herein and shall not beconsidered to be an element or limitation of the appended claims exceptwhere explicitly recited in a claim(s).

One embodiment of the invention is implemented as a program product foruse with a computer system. The program(s) of the program productdefines functions of the embodiments (including the methods describedherein) and can be contained on a variety of computer-readable storagemedia. Examples of computer-readable storage media include (i)non-writable storage media (e.g., read-only memory devices within acomputer such as CD-ROM or DVD-ROM disks readable by an optical mediadrive) on which information is permanently stored; (ii) writable storagemedia (e.g., floppy disks within a diskette drive or hard-disk drive) onwhich alterable information is stored. Such computer-readable storagemedia, when carrying computer-readable instructions that direct thefunctions of the present invention, are embodiments of the presentinvention. Other examples media include communications media throughwhich information is conveyed to a computer, such as through a computeror telephone network, including wireless communications networks.

In general, software routines composed to implement embodiments of theinvention may be part of an operating system or a specific application,component, program, module, object, or sequence of instructions.Computer programs implementing embodiments of invention typicallyinclude a collection of source code files that may be compiled (orinterpreted) into a machine-readable format and hence executableinstructions. Additionally, multiple applications may interact with oneanother, e.g., a user-application program may interact with anotherapplication such as a database to provide an intended service orfunction. Also, such programs typically include variables and datastructures that may reside in memory or on storage devices. In addition,various programs described herein may be identified based upon theapplication for which they are implemented in a specific embodiment ofthe invention. However, it should be appreciated that any particularprogram nomenclature that follows is used merely for convenience, andthus the invention should not be limited to use solely in any specificapplication identified and/or implied by such nomenclature.

FIG. 1 illustrates components of a video analysis andbehavior-recognition system 100, according to one embodiment of thepresent invention. As shown, the behavior-recognition system 100includes a video input source 105, a network 110, a computer system 115,and input and output devices 118 (e.g., a monitor, a keyboard, a mouse,a printer, and the like). The network 110 may transmit video datarecorded by the video input 105 to the computer system 115.Illustratively, the computer system 115 includes a CPU 120, storage 125(e.g., a disk drive, optical disk drive, floppy disk drive, and thelike), and a memory 130 containing both a computer vision engine 135 anda machine-learning engine 140. As described in greater detail below, thecomputer vision engine 135 and the machine-learning engine 140 mayprovide software applications configured to analyze a sequence of videoframes provided by the video input 105.

Network 110 receives video data (e.g., video stream(s), video images, orthe like) from the video input source 105. The video input source 105may be a video camera, a VCR, DVR, DVD, computer, web-cam device, or thelike. For example, the video input source 105 may be a stationary videocamera aimed at a certain area (e.g., a subway station, a parking lot, abuilding entry/exit, etc.), which records the events taking placetherein. Generally, the area visible to the camera is referred to as the“scene.” The video input source 105 may be configured to record thescene as a sequence of individual video frames at a specified frame-rate(e.g., 24 frames per second), where each frame includes a fixed numberof pixels (e.g., 320×240). Each pixel of each frame may specify a colorvalue (e.g., an RGB value) or grayscale value (e.g., a radiance valuebetween 0-255). Further, the video stream may be formatted using knownsuch formats e.g., MPEG2, MJPEG, MPEG4, H.263, H.264, and the like.

As noted above, the computer vision engine 135 may be configured toanalyze this raw information to identify active objects in the videostream, classify the objects, derive a variety of data regarding theactions and interactions of such objects, and supply this information toa machine-learning engine 140. And in turn, the machine-learning engine140 may be configured to evaluate, observe, learn and remember detailsregarding events (and types of events) that transpire within the sceneover time.

In one embodiment, the machine-learning engine 140 receives the videoframes and the data generated by the computer vision engine 135. Themachine-learning engine 140 may be configured to analyze the receiveddata, build semantic representations of events depicted in the videoframes, detect patterns, and, ultimately, to learn from these observedpatterns to identify normal and/or abnormal events. Additionally, datadescribing whether a normal/abnormal behavior/event has been determinedand/or what such behavior/event is may be provided to output devices 118to issue alerts, for example, an alert message presented on a GUIinterface screen. In general, the computer vision engine 135 and themachine-learning engine 140 both process video data in real-time.However, time scales for processing information by the computer visionengine 135 and the machine-learning engine 140 may differ. For example,in one embodiment, the computer vision engine 135 processes the receivedvideo data frame-by-frame, while the machine-learning engine 140processes data every N-frames. In other words, while the computer visionengine 135 analyzes each frame in real-time to derive a set ofinformation about what is occurring within a given frame, themachine-learning engine 140 is not constrained by the real-time framerate of the video input.

Note, however, FIG. 1 illustrates merely one possible arrangement of thebehavior-recognition system 100. For example, although the video inputsource 105 is shown connected to the computer system 115 via the network110, the network 110 is not always present or needed (e.g., the videoinput source 105 may be directly connected to the computer system 115).Further, various components and modules of the behavior-recognitionsystem 100 may be implemented in other systems. For example, in oneembodiment, the computer vision engine 135 may be implemented as a partof a video input device (e.g., as a firmware component wired directlyinto a video camera). In such a case, the output of the video camera maybe provided to the machine-learning engine 140 for analysis. Similarly,the output from the computer vision engine 135 and machine-learningengine 140 may be supplied over computer network 110 to other computersystems. For example, the computer vision engine 135 andmachine-learning engine 140 may be installed on a server system andconfigured to process video from multiple input sources (i.e., frommultiple cameras). In such a case, a client application 250 running onanother computer system may request (or receive) the results of overnetwork 110.

FIG. 2 further illustrates components of the computer vision engine 135and the machine-learning engine 140 first illustrated in FIG. 1,according to one embodiment of the invention. As shown, the computervision engine 135 includes a background/foreground (BG/FG) component205, a tracker component 210, an estimator/identifier component 215, anda context event component 220. Collectively, the components 205, 210,215, and 220 provide a pipeline for processing an incoming sequence ofvideo frames supplied by the video input source 105 (indicated by thesolid arrows linking the components). Additionally, the output of onecomponent may be provided to multiple stages of the component pipeline(as indicated by the dashed arrows) as well as to the machine-learningengine 140. In one embodiment, the components 205, 210, 215, and 220 mayeach provide a software module configured to provide the functionsdescribed herein. Of course one of ordinary skill in the art willrecognize that the components 205, 210, 215, and 220 may be combined (orfurther subdivided) to suit the needs of a particular case and furtherthat additional components may be added (or some may be removed) from avideo surveillance system.

In one embodiment, the BG/FG component 205 may be configured to separateeach frame of video provided by the video input source 105 into astationary or static part (the scene background) and a collection ofvolatile parts (the scene foreground). The frame itself may include atwo-dimensional array of pixel values for multiple channels (e.g., RGBchannels for color video or grayscale channel or radiance channel forblack and white video). In one embodiment, the BG/FG component 205 maymodel background states for each pixel using an adaptive resonancetheory (ART) network. That is, each pixel may be classified as depictingscene foreground or scene background using an ART network modeling agiven pixel. In such a case, mature clusters in the ART network modelinga given pixel are presumed to model a background state and pixel colorvalues in an input frame mapping to a mature cluster are presumed todepict scene background in that frame, where pixels mapping to animmature cluster (or to a new cluster) are presumed to depict an elementof a foreground object (or an emergent background state). Of course,other approaches to distinguish between scene foreground and backgroundmay be used.

Additionally, the BG/FG component 205 may be configured to generate amask used to identify which pixels of the scene are classified asdepicting foreground and, conversely, which pixels are classified asdepicting scene background. The BG/FG component 205 then identifies(contiguous) regions of the scene that contain a portion of sceneforeground (referred to as a foreground “blob” or “patch”) and suppliesthis information to subsequent stages of the pipeline.

The tracker component 210 may receive the foreground patches produced bythe BG/FG component 205 and generate computational models for thepatches. The tracker component 210 may be configured to use thisinformation, and each successive frame of raw-video, to attempt to trackthe motion of an object depicted by a given foreground patch as it movesabout the scene. That is, the tracker component 210 provides continuityto other elements of the system by tracking a given object fromframe-to-frame.

The estimator/identifier component 215 may receive the output of thetracker component 210 (and the BG/FG component 205) and derive featuredata for each tracked foreground object. For example, theestimator/identifier component 215 may derive a variety of microfeatures characterizing different aspects of a tracked foregroundobject, e.g., size, height, width, and area (in pixels), reflectivity,shininess rigidity, etc. Each micro feature may be represented usingnumerical values, e.g., a normalized value between 0 and 1 or a −1representing a null value for a given micro feature. Additionally, theestimator/identifier component 215 may derive kinematic data describingthe actions of a foreground object, e.g., a spatial position, directionof movement, velocity and acceleration, etc. Like the micro features,the kinematic data may be represented using numerical values.

The estimator/identifier component 215 may also include a trainedclassifier trained using a collection of training examples (positiveand/or negative). Once trained, the classifier may be used to assign oneof a set of pre-defined classifications (based on the training examples)to a tracked object, e.g., to classify a foreground object as being a“person,” a “vehicle,” an “unknown,” or an “other.” In this context, theclassification of “other” represents an affirmative assertion that theobject is neither a “person” nor a “vehicle.”

The context event component 220 may receive the output from other stagesof the pipeline (i.e., the tracked objects, the background andforeground models, and the results of the estimator/identifier component215). In one embodiment, the context event component 220 may generate astream of context events regarding objects tracked (by tracker component210) and evaluated (by estimator identifier component 215). For example,the context event component 220 may package the numerical data as astream of micro feature vectors and kinematic data vectors derived for aforeground object and output this to the machine-learning engine 140,e.g., a rate of 5 Hz. In one embodiment, the context events are packagedas being part of a trajectory associated with a given foreground object.As used herein, a trajectory generally refers to a list of vectorspackaging the kinematic data vectors (or micro feature vectors) of aparticular foreground object in successive frames or samples. Eachelement in the trajectory represents the kinematic data captured forthat object at a particular point in time. Typically, a completetrajectory includes the kinematic data obtained when an object is firstobserved in a frame of video along with each successive observation ofthat object up to when it leaves the scene (or becomes stationary to thepoint of becoming part of the scene background). Accordingly, assumingcomputer vision engine 135 is operating at a rate of 5 Hz, a trajectoryfor an object is updated every 200 milliseconds, until complete.

The computer vision engine 135 may take the output from the components205, 210, 215, and 220 describing the observations of motions andactions of the tracked objects in the scene and this information to themachine-learning engine 140. As shown, the machine-learning engine 140includes a primitive event detector 212, a behavioral anomaly detector225, cluster statistics 230, a cortex model component 240, which itselfincludes clustering/sequencing layers 245, and learning engines 250.Additionally, the machine-learning engine 140 includes a clientapplication 250, allowing users to interact with the video surveillancesystem 100 using a graphical user interface.

The machine-learning engine 140 also includes an event bus 222. In oneembodiment, the components of the computer vision engine 135 andmachine-learning engine 140 output data to the event bus 222. At thesame time, the components of the machine-learning engine 140 maysubscribe to receive different events streams from the event bus 222.For example, the cortex model component 240 may subscribe to receive thekinematic data vectors and micro feature vectors output from thecomputer vision engine 135 and use this information to constructprogressively complex abstractions representing behavioral patterns.

In one embodiment, the primitive event detector 212 may be configured toreceive the output of the computer vision engine 135 (i.e., the videoimages, context event stream) and generate a sequence of primitiveevents—labeling the observed actions or behaviors in the video withsemantic meaning. For example, assume the computer vision engine 135 hasidentified a foreground object and classified that foreground object asbeing a vehicle and the context event component 220 estimates thekinematic data regarding the car's position and velocity. In such acase, this information is supplied to the machine learning engine 140and the primitive event detector 212. In turn, the primitive eventdetector 212 may generate a semantic symbol stream corresponding to asimple linguistic description of actions engaged in by the vehicle. Forexample, a sequence of primitive events related to observations of thecomputer vision engine 135 occurring at a parking lot could result inthe following trajectory sequences: a first trajectory where the carappears as follows: “vehicle appears,” “vehicle moves,” “vehicle stops.”A second trajectory could then be generated as: “person appears,”“person moves,” “person disappears from scene.” And a third trajectoryof “person appears,” “person moves towards vehicle,” “person stops,” and“person disappears.” At this point, the trajectory for the vehicle couldcontinue as “vehicle starts moving,” and “vehicle disappears.” Asdescribed in greater detail below, in one embodiment, the trajectoriesof primitive event streams for a given foreground object (e.g., the caror the person) may be input to the first layer of the cortex modelcomponent 240.

Illustratively, the cortex model component 240 includessequencing/clustering layers 245. As noted, the sequencing/clusteringlayers 245 in the cortex model component 240 alternate betweenclustering and sequencing. For example, in one embodiment, a first layercontains clusters of features (e.g., kinematic data vectors output bythe computer vision engine clustered using an adaptive resonance theory(ART) network). A second layer contains sequences of clusters offeatures (e.g., sequences of ART network labels to which successivekinematic data vectors are mapped to), and a third layer containsclusters of sequences of clusters of features, etc. In this manner,lower level concepts, which are learned over smaller space and timescales, are stored in the lower levels of the cortex model component240, and higher level concepts, which are learned over larger space andtime scales, are stored in the higher levels. This approach allows thevideo surveillance system to distinguish unusual events from noise,particularly at higher layers of the cortex model component 240. Aspectsof the clusters generated by the clustering layers of the cortex modelcomponent 240 and the sequences generated by the sequencing layers ofthe cortex model component 240 are described in greater detail below inconjunction with FIGS. 3-10.

In one embodiment, once sequencing/clustering layers 245 in the cortexmodel have observed the scene for a specified period of time, thebehavioral anomaly detector 225 may use the current clusters (orsequences) to evaluate input from the computer vision engine 135,generally in real-time. That is, as the computer vision engine 135builds a trajectory of kinematic data, micro feature data or primitiveevent data while observing a foreground object in the scene, thebehavioral anomaly detector 225 may evaluate the emergent trajectoriesto identify anomalous events, based on the prior observations of thescene as represented by the then existing state of thesequencing/clustering layers 245. For example, if a current input (e.g.,a kinematic data vector) does not map to an ART network cluster with aprobability of mapped to that is above a specified threshold, relativeto the input data being mapped to other clusters in that ART network, acluster anomaly may be issued. Similarly, for sequence layers, if thecurrent input (e.g., a cluster label assigned to a cluster in an ARTnetwork) is not an element of a sequence having a probability ofoccurring above a specified threshold (relative to prior observation), asequence anomaly may be issued. More simply, as clusters and sequencesmodeling a given environment emerge in the clustering/sequencing layers245 (i.e., clusters and sequences modeling the behavior of foregroundobjects in a scene captured in a sequence of video frames), thebehavioral anomaly detector 225 may be configured to generate and issuealerts when input data received from the computer vision engine differsfrom prior observation. In one embodiment, probabilities of observing agiven sequence or input data mapping to a given cluster may be stored bythe cluster statistics 230.

Learning engines 250 represent additional engines (e.g., softwaremodules or components) configured to evaluate data derived from thecomputer vision engine 135 (or components of the machine-learning engine140). For example, in addition to the cortex model competent 240, themachine-learning engine 140 may include support vector machines, Markovmodels, sparse distributed memory structures, neural networks and othercomponents configured to observe and model a scene captured by videoinput source 105.

FIG. 3 further illustrates the cortex model component 240, according toone embodiment of the invention. As shown, the cortex model component240 includes multiple layers—alternating between clustering layers andsequencing layers. Further, the first two layers of the cortex model aresplit between a dorsal side which includes a cluster layer d₁ 315, asequence layer d₂ 320, a cluster layer d₃ 335, and a sequence layer d₄340; and a ventral side, which includes a cluster layer v₁ 325, asequence layer v₂ 330, a cluster layer v₃ 345, and a sequence layer v₄350.

At a combined cluster layer w₁ 355, the output of a sequence layer d₄340 (i.e., a dorsal layer) is combined with the output of a sequencelayer v₄ 350 (i.e., a ventral layer). Thereafter, the cortex modelcomponent 240 includes a set of alternating clustering and sequencelayers w₂₋₃ 360 and 365. Of course, the cortex model component 240 mayinclude more (or fewer) layers than shown in FIG. 3. Further, the cortexmodel component 240 may include more (or fewer) dorsal and ventrallayers, and the number of dorsal and ventral layers need not be equal toone another. For example, the output of sequence layer d₂ 320 may besupplied directly to combined cluster layer w₁ 355. In such a casecluster layer d₃ 335 and sequence layer d₄ 340 could be omitted.

As shown, each successive layer in the cortex model component 240collects data from the layer below, except for the cluster layer d₁ 315(i.e., the first clustering layer in the dorsal side) and the clusterlayer v₁ 325 (i.e. the first clustering layer in the ventral side).Illustratively, a cluster layer d₁ 315 receives primitive objectfeatures 305, i.e., trajectories which include micro feature vectors ofa foreground object, and a cluster layer v₁ 325 receives primitivetrajectory features, i.e., trajectories which include kinematic datavectors. When a specified number of trajectories have been collected ata given level of the sequencing/clustering layers 245, the clusters orsequences at that layer may be updated. In one embodiment, the clusterlayer d₁ 315 and the cluster layer v₁ 325 each update using batches ofone-hundred trajectories. Of course, the amount may be set to suit theneeds of a particular case.

In one embodiment, the first dorsal and ventral cluster layers of thecortex model receive the micro feature data and kinematic data,respectively. That is, these layers cluster the numerical data like thatjust described for the kinematic data vectors received from the computervision engine 135, while higher layers of the cortex model operate onsymbolic data generated by the first sequence layer. As described ingreater detail below, in one embodiment, each cluster layer includes aself-organizing map (SOM) and an adaptive resonance theory (ART) networkused to cluster sequences of input data at that layer of the cortexmodel component 240. And each sequence layer includes a voting expertscomponent configured to generate sequences from clusters input to thatlayer of the cortex model component 240. Thus, the clustering layersgenerate clusters of sequences and the sequencing layers generatesequences of clusters.

In one embodiment, the input data for the first dorsal layer are a timeseries of feature vectors derived from the object's trajectory, i.e.,the collection of micro feature vectors. For example, as noted above,the estimator/identifier component 215 of the computer vision engine 135may derive a variety of micro features characterizing different aspectsof a foreground object, e.g., size, height, width, and area (in pixels),reflectivity, shininess rigidity, speed velocity, etc. In such a case,the resulting micro features may be packed as an object trajectory andpassed to the cluster layer d₁ 315. In response, the cluster layer d₁315 may be configured to cluster different foreground objects as beinginstances of a common object type, based on the similarity of oneobjects' micro features to others. This approach allows distinct objecttypes to emerge from the clustering of micro features (e.g., using anART network to cluster the micro features). For example, the microfeatures of multiple passenger cars may all map to a common cluster inan ART network at the cluster layer d₁ 315, and therefore, be presumedas being instances of a common agent type. In such a case, the clusterlayer d₁ 315 does not classify an observed vehicle as being a “passengercar” directly, but instead, as being an instance of an arbitrary objecttype having micro features similar to other passenger cars observed bythe computer vision engine 135. At higher layers of the cortex modelcomponent 240 progressively more complex abstractions may emerge. Forexample, while distinct ART network clusters may emerge in the clusterlayer d₁ 315 for observed micro features of passenger cars, motorcycles,and bicycles, at a higher level of abstraction, a cluster may emergerepresenting a more abstract concept, e.g., “vehicles.”

On the ventral side, the cluster layer v₁ 325, the features 310 arekinematic variables of the trajectory of an observed foreground objectincluding, but not limited to time, position, velocity, andacceleration. Alternatively (or additionally) the features passed to thecluster layer v₁ 235 may include a trajectory of primitive eventsgenerated by the primitive event detector 212, but not limited to: stop,start, turn, appear, disappear etc.

In one embodiment, layers in the context model component 240 may beconfigured to provide feedback to the layer below it. For example,suppose cluster layer w_(i) has an element that is between c_(i1) andc_(i2), but a bit closer to c_(i2). However sequence layer w_(i+1) isbuilding sequence c_(ij) c_(ik) . . . and the sequence c_(ij) c_(ik)c_(i1) is much more probable than c_(ij) c_(ik) c_(i2). In such a case,layer w_(i+1) may provide enough feedback to layer w_(i) so that theelement in question would be assigned to cluster c_(i1) rather thanc_(i2). Thus, the “expectations” of a sequencing layer may influence theclustering of inputs performed by the layer below it. Additionally, asthe sequences and clusters mature in the sequence layers and clusterlayers, anomalies may be generated when input data does not match wellwith a mature model of behavior at a given layer in the cortex modelcomponent 240.

FIG. 4 illustrates a method 400 for the cortex model component 240 ofFIG. 2 to evaluate a sequence of video frames using alternatingclustering and sequencing layers, according to one embodiment of theinvention. As shown, the method 400 begins at step 405 where the lowestlayer of the cortex model component 240 receives sensory input data fromthe computer vision engine. For example, as described above, thecomputer vision engine 105 may supply a stream of context events whichinclude both the micro feature data and the kinematic data derived foreach foreground object in a scene (at a rate of 5 Hz).

At step 410, as the context events are received, the micro feature datamay be passed to a first dorsal layer of the cortex model component 240,and the kinematic data may be passed to the first ventral layer of thecortex model component 240. At step 415, the respective dorsal andventral cluster layers receiving the input data generate clusters offeatures from the input data. For example, the cluster layer may map theinput data to a cluster in an adaptive resonance theory (ART) network.That is, the ART network is used to generate clusters modeling the inputdata. Once the clusters have matured, e.g., after a specified period oftime or after clustering a specified minimum number of input datavalues, new input data values are mapped to clusters in the ART network.In such a case, the output of that cluster layer may be a sequence oflabels assigned to the particular ART network clusters to whichsuccessive inputs data are mapped. Next, at step 420, the sequence layerreceiving input data from the lower cluster layer may generate sequencesof clusters. For example, the sequence layer may use a voting expertscomponent to subdivide a sequence of ART network labels received fromthe clustering layer into one or more segments. In such a case, theoutput of that sequencing layer is the segments induced by the votingexperts in the sequence of ART network labels received from theclustering layer. At step 425, if more layers remain in the cortex modelcomponent 240, then the process may be repeated using the segmentsidentified by the sequencing layer. That is, the segments identified bythe sequencing layer are clustered using an ART network in the nextcluster layer.

FIG. 5 illustrates sensory data passed to a first cluster layer of thecortex model component 240 of FIG. 2, according to one embodiment of theinvention. In particular, FIG. 5 illustrates data used to train an ARTnetwork in a first cluster layer of the cortex model using a selforganizing map (SOM) 515. Illustratively, the kinematic data vectors (k)derived for foreground objects in a sequence of video frames are batchedinto a set of trajectories T_(1-n) 510—one trajectory (T) for eachforeground object. In one embodiment, the cluster layer batchestrajectories (T) for n objects (e.g., 100 foreground objects) and thenusing the list of kinematic vectors for those objects trains the SOM515. Further, the cluster layer may use a fixed number of kinematicvectors from each trajectory (T) to train the SOM 515. For example, thecluster layer may select 10 equally spaced kinematic vectors from eachtrajectory T. Thus, for a trajectory of 1500 kinematic vectors(representing a foreground object present in the scene for five minutes,sampled at a rate of 5 hz), the kinematic vectors corresponding to the1^(st), 150^(th), 300^(th) . . . 1500^(th) ones in the trajectory forthis foreground object may be used to train the SOM 515.

In this example, a kinematic vector (k) 505 includes six components <x,y, v_(x), v_(y), a_(x), a_(y)> representing the spatial position of anobject (x, y) the velocity (v_(x), v_(y)) and acceleration (a_(x),a_(y)) of the object in a sequence of video frames. In one embodiment,the (x, y) components may be defined as follows:

${x = {\overset{\sim}{x} + \frac{w}{2}}},{y = {\overset{\sim}{y} + \frac{w}{2}}}$where {tilde over (x)} and {tilde over (y)} are the kinematiccoordinates, the point in a frame corresponding to the upper left handcorner of an image bounding box around a foreground object. And thevelocity (v_(x), v_(y)) components may be defined as follows:

${v_{x} = \frac{{\overset{\sim}{v}}_{x}}{w}},{v_{y} = \frac{{\overset{\sim}{v}}_{y}}{h}}$where {tilde over (v)}_(x) and {tilde over (v)}_(y) are the kinematicvelocity components, and h and w are the height and width of the imagebounding box, respectively. And the acceleration (a_(x), a_(y))components may be defined as follows:

${a_{x} = \frac{{\overset{\sim}{a}}_{x}}{w}},{a_{y} = \frac{{\overset{\sim}{a}}_{y}}{h}}$where ã_(x) and ã_(y) are the kinematic components acceleration. Once ntrajectories (T) are available, the batched trajectories 510 are mappedto nodes in SOM 515. As is known, a self-organizing map (SOM) is anartificial neural network trained using unsupervised learning to producea low-dimensional (typically two-dimensional) representation of theinput space of the training samples, referred to as a map. The map mayinclude fixed number of nodes, and a weight vector may represent eachnode. For example, node 525 of SOM 515 includes a vector 520(represented as an arrow). Other nodes in SOM 515 are depictedsimilarly. Once trained, the weight vectors in each node of the SOM(e.g., vector 520) may be clustered using an adaptive resonance theory(ART) network.

For example, FIG. 6 illustrates a data flow for training a cluster layer600 in the cortex model component 240 of FIG. 2, according to oneembodiment of the invention. In this example, cluster layer 600represents the first ventral layer of the cortex model component 240.Thus, cluster layer 600 receives the kinematic data vectors from thecomputer vision engine 135. As shown, a first batch of n trajectories605 is normalized at 610 (e.g., such that the numerical data in eachtrajectory has a mean of 0 and a variance of 1). The normalized vectorsare mapped to the nodes of a self organizing map SOM 1 615. At 620, theresulting node weight vectors in the nodes of SOM 1 are denormalized andprovided as six-dimensional inputs to an ART network 625.

As is known, an ART network provides a specialized neural networkconfigured to create clusters from vector inputs of N elements. Forexample, an ART network may receive a vector as input and either updatean existing cluster or create a new cluster, as determined using achoice test and a vigilance test for the ART network. Each clusteritself may be characterized by a mean and a variance from a prototypeinput representing that cluster. The mean specifies a center locationfor the cluster (in an N-dimensional space for N elements) and thevariance specifies a radius of the cluster. The prototype is generatedfirst, as a copy of the input vector used to create a new cluster.Subsequently, the prototype may be updated as new inputs are mapped tothat cluster.

As stated, inputs are mapped to clusters in an ART network using achoice test and a vigilance test. The choice and vigilance tests areused to evaluate the vector passed to the ART network and select whatcluster to map the inputs to (or create a new cluster). The choice testgenerally provides a ranking of the existing clusters, relative to thevector input data. Once ranked, the vigilance test evaluates theexisting clusters to determine whether to map the input to a givencluster. If no cluster is found to update using the data supplied to theinput layer, evaluated sequentially using the ranked clusters, then anew cluster is created. That is, once a pattern is found (i.e., theinput “matches” an existing cluster according to the choice andvigilance tests), the prototype for that cluster is updated based on thevalues of the input vector moving the cluster slightly towards the inputpattern (in the N-dimensional space of the ART network). Otherwise, ifthe input vector does not match any available cluster (using thevigilance test), the ART network may create a new cluster by storing anew pattern similar to the input vector. Subsequent input vectors thatmost closely resemble the new cluster (relative to the others) are thenused to update that cluster.

The vigilance parameter has considerable influence on an ART network:higher vigilance produces many, fine-grained clusters, while a lowervigilance results in more-general clusters. Further, the inputs may bebinary values (generally referred to as an ART1 network), or may becontinuous values (generally referred to as an ART2 network). Othervariations of the ART network include ART3, ARTMAP, and FUZZY ARTnetworks.

As stated, inputs mapping to an existing ART network cluster may be usedto update a mean and variance for each dimension of the ART network,changing the position, shape and size of the cluster. Alternatively, theclusters may be defined using a mean and a covariance. Doing so resultsin a more accurate boundary for each cluster. However, using acovariance approach increases the computational complexity. Thus, theactual approach may be tailored to suit the needs of a particular case.

In context of the present invention, the ART network 625 may be trainedusing the denormalized weight vectors from SOM 1 615. Once trained, SOM1 615 may be discarded. Thereafter, the cluster layer 600 may evaluatethe trajectories of foreground objects in the scene using trained ARTnetwork 625. For example, each new kinematic data vector for a givenforeground object in the scene may be passed to the ART network 625. Inresponse, the ART network may specify a mapping to a “closest” clusterwithin ART network 625 for that input data vector (determined in thefirst cluster layers, e.g., using a Euclidian distance measure). If thedistance between the input data and the closest cluster in the ARTnetwork 625 exceeds a specified amount, or if the closest cluster hasnot been reinforced a specified minimum number of times (i.e., thecluster is “immature”), an alert specifying the occurrence of ananomalous observation may be generated.

As a sequence of kinematic data vectors are mapped to ART network 625, asequence of ART labels 640 is generated. In one embodiment, the sequenceof ART labels 640 is passed to the sequence layer for segmentation by avoting experts component. Thus, the ART network 625 allows the cortexmodel component 240 to transition from numerical representation ofobservations (the kinematic data vectors) to a symbolic representation(the sequence of ART network labels).

At the same time, the cluster layer 600 continues to batch trajectoriesfor foreground objects until another n trajectories are available, e.g.,batch 2 630. At 635, the n trajectories in batch 2 630 may benormalized, passed to the nodes of a SOM 2 635, and denormalized in thesame manner described for the kinematic data vectors in batch 1 605.Further, the denormalized node weight vectors in SOM 2 may be used toupdate the clusters in the ART network 625. Doing so allows the ARTnetwork 625 to further refine the clusters in that ART network as wellas respond to changes in behavior occurring in the scene. That is, asnew behaviors emerge in the scene, new clusters will emerge in the ARTnetwork 625. Further, over time, as the new clusters mature, the clusterlayer 600 may treat input data mapping to such clusters as beingrepresentative of an observation of normal behavior. Thus, when inputdata (e.g., a kinematic data vectors) maps to a cluster in ART network625 that has not matured—it may represent a new emergent behavior or theobservation of an anomalous event (at that layer of the cortex modelcomponent 240). Accordingly, in one embodiment, the ART network 625 mayissue an alert to users of the video surveillance system when such anevent occurs.

The process of batching trajectories and refining the ART network 625may be repeated indefinitely. In each iteration, a batch of kinematicdata vectors (or micro-feature vectors) is mapped into a self organizingmap (SOM) and the resulting nodes of the SOM are used to train (orupdate) clusters in the ART network 625. Further, once trained, the ARTnetwork 625 may be used to generate a sequence of ART network labelsfrom observations of a foreground object in the scene. Such a sequenceis passed to the next sequencing layer, which, in turn, creates segmentsof the ART network labels themselves clustered by an ART network in thenext cluster layer, and the process repeats itself.

This result is shown in FIG. 7 which illustrates a cluster layer 705 anda sequence layer 710 of the cortex model component 240 of FIG. 2,according to one embodiment of the invention. As shown, the clusterlayer 705 includes a self-organizing map (SOM) 720 and an ART network725. The cluster layer 705 maps context events 730 to nodes of the SOM720. Illustratively, the context event 730 includes a trajectory vector732. And the trajectory vector 732 itself includes the kinematic datavectors k_(i) for an object represented by the context event 730 (again,sampled at a 5 Hz rate). That is, each vector k_(i) in the trajectoryvector 732 stores the kinematic data derived for an object observed inthe scene by the computer vision engine 135 at successive points intime.

As described above, the cluster layer 705 may be configured to map eachelement in a trajectory vector included in the context event 730 to anode in the SOM 720 and the resulting node weight vectors 722 in SOM 720may be used to train the ART network 725. For example, as shown, thenode weight vectors of nodes 0, 1, 4, and 5 in SOM 325 result in acluster 745 (labeled as cluster “A”) in the ART network 725 and nodes 9and 12 result in another cluster (labeled as cluster “B” in the ARTnetwork 725).

Once the ART network 725 is trained using the SOM node weight vectors,the kinematic data vectors k_(i) may be clustered using that ART network725. FIG. 7 shows this as kinematic data vectors k_(i) 732 ₁ of contextevent 730 ₁ being passed directly to the ART network 725. This resultsin a sequence of ART labels in the ART network 725. Specifically, theelements of k₀, k₁, k₂, k₃, k₅, k₆, k₇ in the trajectory vector 732 ₁are mapped to clusters labeled D, D, B, B, C, C, F, F, respectively.Note, the particular sequence at which nodes of the trajectory vector732 ₁ are mapped into the SOM 325 creates an ordered sequence 747.Removing redundant elements results in a sequence of {D, B, C, F}, shownin FIG. 7 as label sequence 750.

In one embodiment, the sequence layer 710 includes software modulesconfigured to evaluate sequences generated by the cluster layer 705(e.g., the label sequence 750). Illustratively, the sequence layer 710includes an ngram trie 755 generated by a voting experts component 760.As is known, the voting experts method provides an unsupervised approachfor identifying chunks in sequences (e.g., the label sequence 750)having low entropy within a chunk and high entropy between chunks. Thevoting experts component 760 evaluates the frequency of a given inputsequence and the uncertainty of the symbol that follows a sequence. Inparticular, voting experts component 760 slides a window of length Lacross the label sequence 750 and votes to place boundaries in such away as to maximize the frequency of the subsequences between theboundaries, and to maximize the uncertainty of the charactersimmediately after boundaries. Then the voting experts induce a segmentin the symbol stream at locations that have a number of votes exceedinga minimum vote count M. That is, the voting experts method looks for twocharacteristics of chunks: the entropy or unpredictability of elementswithin a chunk is relatively low, whereas the entropy orunpredictability of elements between chunks is relatively high. Bymaximizing the frequencies of the segments in the input symbol stream,the voting experts method minimizes the unpredictability within asegment, and by maximizing the unpredictability of the symbols thatfollow a segment, voting experts seeks to maximize the unpredictabilitybetween segments.

In one embodiment, the voting experts component 760 may include aninternal entropy expert and a boundary entropy expert to evaluate asequence received from the cluster layer. In particular, the votingexperts component 760 may segment the sequence of ART network labels ina given trajectory to maximize the entropy between two segments (asvoted for by the boundary entropy expert) and minimize the internalentropy in each segment (as voted for by the internal entropy expert).Once segmented, the sequence layer may be configured to identifyanomalous segments and sequences, relative to segments and sequencespreviously derived from the sequence of video frames and processed bythe cluster and sequence layer. Additional details of the voting expertsmethod are described in “Voting Experts: An Unsupervised Algorithm forSegmenting Sequences,” by P. Cohen, et al., published in IntelligentData Analysis, 2007.

FIG. 7 shows sequence labels 750 (which includes the labels of {D, B, C,F}) being supplied the sequence layer 710. In one embodiment, thesequences received by the sequence layer 710 may be stored in a pool andonce a threshold number of trajectories are available (e.g., 100) thevoting experts component 760 may generate (or update) the ngram trie755, as well as determine the internal entropies and the boundaryentropies for each traceable sequences in the ngram trie 755. Oncetrained, live sequences may be segmented as new ART labels are received(e.g., the sequence of ART labels 640 of FIG. 6).

In one embodiment, the frequency of occurrence for an observed sequence(e.g., the label sequence 750) may be determined from the ngram trie(which records the frequency of all observed sequences). As segments areinduced in an emerging sequence, the voting experts component 760 maydetermine the probability of observing the sequence itself, as well asthe probability of observing the particular segments induced in thesequence by the voting experts component 760. In the event that theprobability of observing a given sequence (or segment) falls below agiven threshold, an alert may be generated, when such a sequence (orsegment) is, in fact, observed. Further, as noted above, the sequencelayer may provide feedback to the clustering layer regarding theprobability of observing different ART network labels in an emergingsequence. Thus, if after observing {D, B, C} the probability of thenobserving “F” is much greater than observing “E,” then this informationmay be provided to the clustering layer and used to influence themapping of an input data vector to a cluster in the ART network 725.

In this example, the voting experts 760 receives the label sequence 750of {D, B, C, F} and, based on the votes of the internal entropy expertand the boundary entropy expert votes to create the segmented sequences780. Specifically, a segment of (D, B) 785 and a segment of (C, F) 790is generated. Note, as a pool of segments emerges from the sequencinglayer 710, the segments themselves provide a pool of data for the nextcluster layer. That is, the cluster layer following sequence layer 710clusters the sequences generated by the cluster layer 710 (which arethen sequenced and segmented by the next sequence layer, etc.).

However, as noted above, unlike the numerical data input to the firstventral and dorsal cluster layers of the cortex model component 240, theoutput of the sequencing layer is a symbolic symbol stream (i.e., thesequence of ART network labels segmented by the sequencing layer 710).In order to cluster the symbolic data, a formal language measure and adistance measure is used to train a self organizing map at higher layersof the cortex model component 240. In one embodiment, the formallanguage measure is given by:μ(L)=Σ_(i=1) ^(∞) w _(i) n _(i)(L),where L is a formal language, 0≦μ≦1 is its measure, n_(i)(L) is thenumber of strings of length i and, w_(i)=(2k)⁻¹, is the alphabet length.The formal language measure is used to derive a distance measure betweenany two formal languages where a distance measure d is given by:d(L ₁ ,L ₂)≡μ(L ₁ ∪L ₂ −L ₁ ∩L ₂),the measure of the symmetric set difference between the two languages.In other words, it is the measure of the language containing the stringsthat are in L₁ or L₂ but not both. The distance of each sequence (aformal language with a single string) from a given sequence layer andeach cluster at the next higher layer, can be calculated.

Using these equations, some, but not all of the vector algebraoperations can be performed. Formal language vectors can be subtractedand absolute values can be taken, but multiplication by a scalar is notdefined. This allows clustering by ART but not by SOM. The higher levelcluster layers in this implementation of the invention use ART only forthis reason. The symbolic data output by a given sequence layer in thecortex model component 240 may be clustered by the above ART networkwhose labels are passed to the next sequence layer.

FIG. 8 illustrates a method 800 for training a self-organizing map (SOM)and an adaptive resonance theory (ART) network at both a first clusterlayer and higher cluster layers of the cortex model component 240 ofFIG. 2, according to one embodiment of the invention. As shown, themethod 800 begins at step 805 where a cluster layer batches feature datafrom the computer vision engine (e.g., trajectories of micro featurevectors passed to the first dorsal cluster layer or trajectories ofkinematic data passed to the first ventral cluster layer). At highercluster layers of the cortex model component 240, batches of segments ofsequences output from a sequence layer are clustered. Additionally, asnoted, the output of sequence layers on the dorsal and ventral sides maybe combined in the cortex model component 240. In such a case, at thecluster layer combining the dorsal and ventral sides, the input to thecombining cluster layer may be the cross product of segments output froma dorsal side sequence layer and segments output from a ventral sidesequence layer.

For each batch of input data from the computer vision engine 135, forthe first cluster layer, steps 815, 820, and 825 are performed. At step815, the input batch is used to train a self organizing map (SOM) usingthe vectors in a given training batch. At step 820, the resulting nodeweight vectors in the SOM are passed as input vector values to anadaptive resonance theory (ART) network, resulting in a set of ARTnetwork clusters. At step 825, the input vectors may be matched directlyagainst the ART network (trained using the SOM node weight vectors) todetermine a sequence of ART network labels to pass to an adjacent,higher sequence layer. Further, once done, as new input values arereceived based on subsequent observations and collected to from the nextbatch (step 805), the new input values are mapped to nodes in the ARTnetwork (step 825). For example, new kinematic data vectors or microfeature vectors in a trajectory of a foreground object may be passed toa first cluster layer. And in response the clusters which the new inputvalues are mapped to are passed to the next sequence layer as a sequenceof ART network labels.

For higher layers, new segments output from an adjacent, lower sequencelayer are input to the next cluster layer. Such segments may be used totrain an ART network at that cluster layer. Accordingly, at step 830each vector of feature data collected from an adjacent, lower sequencelayer is passed to an ART network. Thereafter, when new observations areavailable, i.e., new segments are received from an adjacent, lower,sequence layer, such input vectors are matched against clusters in anART network at the given cluster layer to determine a sequence of ARTnetwork cluster labels to pass to an adjacent, higher, sequence layer.

FIG. 9 illustrates a method 900 for the cortex model component 240 ofFIG. 2 to model progressively more complex levels of behavior, accordingto one embodiment of the invention. As shown, the method 900 begins atstep 905 where a cluster layer receives a set of sequences segmented byvoting experts in an adjacent, lower sequencing layer. In oneembodiment, the cluster layer generates a formal language vector foreach segment. In one embodiment, this may be done by using a finiteportion of an infinite dimensional vector where each dimensionrepresents one of the possible strings in the alphabet of a given formallanguage. If the string is actually in the language, then the componentcorresponding to the string is equal to 1, otherwise the component isequal to 0. The strings are ordered lexicographically. Once all thevector components past a given length are zero, the vector can be cutoff. The measure ensures that even a language with an infinite number ofstrings will have a finite measure.

At step 910, the cluster layer determines a formal language distance foreach sequence received at step 905 to each cluster in the ART network ofthat cluster layer, e.g., based on the formal language vectorcorresponding to a given segment and the equations set forth above. Atstep 915, the sequence may be added to an existing cluster or a newcluster may be started. That is, the input is mapped into the ARTnetwork. At step 920, depending on how the ART network maps a givensequence to the ART network at that cluster layer, an anomaly may beissued. Additionally, the cluster to which each respective vector ismapped to may be output as a sequence element passed to the adjacent,higher sequencing layer.

FIG. 10 illustrates a method 1000 for the cortex model component 240 ofFIG. 2 to identify occurrences of unusual behavior (anomalies) forprogressively more complex levels of behavior based on priorobservations of a scene, according to one embodiment of the invention.As shown, the method 1000 begins at step 1005 where the computer visionengine observes a scene and passes data to the cortex model component ofa machine learning engine.

As described above, as data is pushed from the computer vision engine, afirst dorsal cluster layer and a first ventral cluster layer beginclustering the kinematic and micro feature data. For example, the inputdata may be a kinematic data vector passed to a first ventral layer ofthe cortex model component 240 or a micro feature vector passed to afirst dorsal cluster layer of the cortex model component 240. Such datamay be batched and mapped into the nodes of a self organizing map (SOM)used to train an ART network, i.e., to develop a model of scenebehavior. In turn, as new observations are mapped to the ART network,the resulting sequences of ART network labels are segmented by the firstsequencing layer—producing pools of segments passed to the next clusterlayer—and so on. That is, at higher layers of the cortex modelcomponent, the inputs to a cluster layer may be a segment induced by avoting experts component in a sequence of ART network labels.

In one embodiment, each cluster layer may be evaluated to identify avariety of different anomalous inputs. As progressively higher layers ofthe cortex model component represent progressively higher levels ofabstraction, anomalies occurring in the higher levels of the cortexmodel represent observations of behavioral anomalies corresponding toprogressively more complex patterns of behavior.

For example, at step 1010, the cortex model component 240 determineswhether the initial cluster layer has batch of data for training a SOM.If so, at step 1015, such a batch of training data is mapped into thenodes of a SOM and the resulting nodes may be evaluated for SOM traininganomalies. For example, a batch of feature based vectors output by thecomputer vision engine may be mapped to the input nodes of a SOM. In oneembodiment the distance between every SOM input (e.g., each trajectorykinematics vector) and the best matching node in the SOM is identified.From this information a mean and standard deviation is determined. Anyvector with a distance greater than two standard deviations (or otheruser specified distance) from the mean may be flagged as an anomaly. Asnoted, for the first dorsal layer and first ventral layer anN-dimensional Euclidean distance measure may be used.

Additionally, a “rare node” SOM training anomaly may also be identified.For example, the cortex model component may maintain a count of thenumber of inputs mapped to each SOM node and from this informationdetermine the mean and standard deviation for distribution of input dataand the nodes of a given SOM. In one embodiment, if the mean minus twostandard deviations is equal to or greater than one, then the inputs inany node whose total number of inputs is equal to or less than thisnumber may be flagged as an anomaly.

At step 1020, a set of node weight vectors may be clustered by anadaptive resonance theory (ART) network. And at step 1025, the cortexmodel component may evaluate the ART network clusters for traininganomalies. For example, similar to the “rare node” SOM training anomaly,the cortex model component may maintain a count of the number of inputsassigned to a given ART network cluster and also determine a mean andstandard deviation of inputs mapping to each such cluster. In oneembodiment, if the mean minus two standard deviations is equal to orgreater than one, then the inputs in any cluster whose total number ofinputs is equal to or less than this number may be flagged as ananomaly.

Anomalies may also be identified using the trained ART network. Forexample, at step 1030 the cortex model component may determine that aninput data vector is available for the ART network at a given clusterlayer. Again, the input data may be a micro feature vector, a kinematicsdata vector, or a segment induced in a sequence of ART network labels.At step 1035, once such an input data is mapped to a cluster in atrained ART network, the cortex model component may evaluate whichcluster the input data is mapped to, and in some cases identify ananomaly, e.g., if the input to a trained ART network does not match anycluster or when the input maps to a “rare” or “immature” cluster. Forexample, using the vigilance parameter, it is possible that an inputwill not match any existing ART cluster. In such a case, the input isflagged as an anomaly and a new node may be created in the ART networkso that the corresponding input data can be passed to the next sequencelayer in the cortex model. That is, when input data results in a newnode in the ART network, a new cluster label is assigned, allowing thenew cluster to be represented in sequences of ART network labels passedto the sequence layer for segmentation by the voting experts componentat that sequence layer. Similarly, if the cluster to which the inputdata is mapped to has not been reinforced a specified minimum number oftimes (i.e., the cluster is “immature”), an alert specifying theoccurrence of an anomalous observation may be generated

Advantageously, as described, embodiments of the invention providetechniques for a video surveillance system to learn to recognize complexbehaviors by analyzing pixel data using alternating layers of clusteringand sequencing. One embodiment includes a video surveillance systemconfigured to observe a scene (as depicted in a sequence of videoframes) and, over time, develop hierarchies of concepts includingclasses of objects, actions and behaviors. That is, the videosurveillance system may develop models at progressively more complexlevels of abstraction used to identify what events and behaviors arecommon and which are unusual. When the models have matured, the videosurveillance system issues alerts on unusual events. This may occurautomatically, without user input and using any sensors that can trackand classify objects.

While the foregoing is directed to embodiments of the present invention,other and further embodiments of the invention may be devised withoutdeparting from the basic scope thereof, and the scope thereof isdetermined by the claims that follow.

1. A computer-implemented method for analyzing a sequence of videoframes depicting a scene captured by a video camera, the methodcomprising: receiving a set of data inputs derived by a computer visionengine configured to analyze pixels depicting a plurality of foregroundobjects in the sequence of video frames; modeling behavior of theforeground objects in the scene by passing the received sensory datainputs to a first cluster layer of a plurality of layers, wherein theplurality of layers alternate between cluster layers and sequence layersand wherein the cluster layers generate clusters of sequences and thesequence layers generate sequences of clusters and wherein each clusterlayer generates clusters using a self organizing map (SOM) and anadaptive resonance theory (ART) network; evaluating one or more of thecluster layers to identify an occurrence of a behavioral anomaly basedon an input to one of the cluster layers; and publishing an alertmessage indicating the occurrence of the behavioral anomaly.
 2. Themethod of claim 1, further comprising: batching, at a given one of theplurality of cluster layers, a set of elements of input data used totrain the SOM; and training the SOM using the batched input data,wherein evaluating the cluster layers to identify the occurrence of thebehavioral anomaly in the given cluster layer comprises: identifying amatching node in the SOM for each element of batched input data;determining a mean and standard deviation for a distance between eachelement of input data and the matched node of the SOM, and upondetermining a first one of the elements of input data is matched to anode in the SOM at a distance greater than two standard deviations fromthe mean, flagging the first element of input data as being indicativeof the occurrence of the behavioral anomaly in the given cluster layer.3. The method of claim 1, further comprising: batching, at a given oneof the plurality of cluster layers, a set of node weight vectorsassociated with nodes of the SOM; training the ART network using thebatched node weight vectors, wherein evaluating the cluster layers toidentify the occurrence of the behavioral anomaly in the given clusterlayer comprises: identifying a matching cluster in ART network for eachnode weight vector used to train the ART network; determining a mean andstandard deviation for a distance between each node weight vector andthe matched cluster of the ART network, and upon determining a first onenode weight vectors is matched to a cluster in the ART network at adistance greater than two standard deviations from the mean, flaggingthe node weight vector as being indicative of the occurrence of thebehavioral anomaly in the given cluster layer.
 4. The method of claim 1,wherein evaluating one or more of the cluster layers to identify anoccurrence of a behavioral anomaly in one of the cluster layerscomprises one of (i) determining that the ART network generated a newcluster to model a received set of input data mapped to clusters in theART network; and (ii) determining that the ART network mapped a receivedset of input data to a cluster in the ART network that has not beenreinforced with a threshold number of inputs.
 5. The method of claim 1,wherein cluster layers subsequent to the first cluster layer generateclusters from sequences generated by a previous sequence layer andwherein the sequence layers generate sequences of clusters generated bya previous cluster layer.
 6. The method of claim 1, wherein the firstcluster layer includes a dorsal side cluster layer and a ventral sidecluster layer, and wherein the set of data inputs passed to the ventralside cluster layer includes a plurality of numerical kinematic datavectors characterizing a set of kinematics of the foreground objects inthe scene and wherein the dorsal side cluster layer includes a pluralityof numerical feature data vectors characterizing a set of micro featuresof the foreground objects.
 7. The method of claim 6, wherein the dorsalside cluster layer outputs a symbolic symbol stream passed to a firstdorsal side sequence layer and wherein the ventral side cluster layeroutputs a second symbolic symbol stream passed to a first ventral sidesequence layer.
 8. The method of claim 6, wherein the first dorsal sidesequence layer and the first ventral side sequence layer each include avoting experts component configured to induce one or more segments inthe symbolic symbol stream passed to the respective first dorsal sidesequence layer and the first ventral side sequence layer.
 9. Acomputer-readable storage medium containing a program which, whenexecuted by a processor, performs an operation for analyzing a sequenceof video frames depicting a scene captured by a video camera, theoperation comprising: receiving a set of data inputs derived by acomputer vision engine configured to analyze pixels depicting aplurality of foreground objects in the sequence of video frames;modeling behavior of the foreground objects in the scene by passing thereceived sensory data inputs to a first cluster layer of a plurality oflayers, wherein the plurality of layers alternate between cluster layersand sequence layers and wherein the cluster layers generate clusters ofsequences and the sequence layers generate sequences of clusters andwherein each cluster layer generates clusters using a self organizingmap (SOM) and an adaptive resonance theory (ART) network; evaluating oneor more of the cluster layers to identify an occurrence of a behavioralanomaly based on an input to one of the cluster layers; and publishingan alert message indicating the occurrence of the behavioral anomaly.10. The computer-readable storage medium of claim 9, wherein theoperation further comprises: batching, at a given one of the pluralityof cluster layers, a set of elements of input data used to train theSOM; and training the SOM using the batched input data, whereinevaluating the cluster layers to identify the occurrence of thebehavioral anomaly in the given cluster layer comprises: identifying amatching node in the SOM for each element of batched input data;determining a mean and standard deviation for a distance between eachelement of input data and the matched node of the SOM, and upondetermining a first one of the elements of input data is matched to anode in the SOM at a distance greater than two standard deviations fromthe mean, flagging the first element of input data as being indicativeof the occurrence of the behavioral anomaly in the given cluster layer.11. The computer-readable storage medium of claim 9, wherein theoperation further comprises: batching, at a given one of the pluralityof cluster layers, a set of node weight vectors associated with nodes ofthe SOM; training the ART network using the batched node weight vectors,wherein evaluating the cluster layers to identify the occurrence of thebehavioral anomaly in the given cluster layer comprises: identifying amatching cluster in ART network for each node weight vector used totrain the ART network; determining a mean and standard deviation for adistance between each node weight vector and the matched cluster of theART network, and upon determining a first one node weight vectors ismatched to a cluster in the ART network at a distance greater than twostandard deviations from the mean, flagging the node weight vector asbeing indicative of the occurrence of the behavioral anomaly in thegiven cluster layer.
 12. The computer-readable storage medium of claim9, wherein evaluating one or more of the cluster layers to identify anoccurrence of a behavioral anomaly in one of the cluster layerscomprises one of (i) determining that the ART network generated a newcluster to model a received set of input data mapped to clusters in theART network; and (ii) determining that the ART network mapped a receivedset of input data to a cluster in the ART network that has not beenreinforced with a threshold number of inputs.
 13. The computer-readablestorage medium of claim 9, wherein cluster layers subsequent to thefirst cluster layer generate clusters from sequences generated by aprevious sequence layer and wherein the sequence layers generatesequences of clusters generated by a previous cluster layer.
 14. Thecomputer-readable storage medium of claim 9, wherein the first clusterlayer includes a dorsal side cluster layer and a ventral side clusterlayer, and wherein the set of data inputs passed to the ventral sidecluster layer includes a plurality of numerical kinematic data vectorscharacterizing a set of kinematics of the foreground objects in thescene and wherein the dorsal side cluster layer includes a plurality ofnumerical feature data vectors characterizing a set of micro features ofthe foreground objects.
 15. The computer-readable storage medium ofclaim 14, wherein the dorsal side cluster layer outputs a symbolicsymbol stream passed to a first dorsal side sequence layer and whereinthe ventral side cluster layer outputs a second symbolic symbol streampassed to a first ventral side sequence layer.
 16. The computer-readablestorage medium of claim 14, wherein the first dorsal side sequence layerand the first ventral side sequence layer each include a voting expertscomponent configured to induce one or more segments in the symbolicsymbol stream passed to the respective first dorsal side sequence layerand the first ventral side sequence layer.
 17. A system, comprising: avideo input source configured to provide a sequence of video frames,each depicting a scene; a processor; and a memory containing a program,which, when executed on the processor is configured to perform anoperation for analyzing the scene, as depicted by the sequence of videoframes captured by the video input source, the operation comprising:receiving a set of data inputs derived by a computer vision engineconfigured to analyze pixels depicting a plurality of foreground objectsin the sequence of video frames, modeling behavior of the foregroundobjects in the scene by passing the received sensory data inputs to afirst cluster layer of a plurality of layers, wherein the plurality oflayers alternate between cluster layers and sequence layers and whereinthe cluster layers generate clusters of sequences and the sequencelayers generate sequences of clusters and wherein each cluster layergenerates clusters using a self organizing map (SOM) and an adaptiveresonance theory (ART) network, evaluating one or more of the clusterlayers to identify an occurrence of a behavioral anomaly based on aninput to one of the cluster layers, and publishing an alert messageindicating the occurrence of the behavioral anomaly.
 18. The system ofclaim 17, wherein the operation further comprises: batching, at a givenone of the plurality of cluster layers, a set of elements of input dataused to train the SOM; and training the SOM using the batched inputdata, wherein evaluating the cluster layers to identify the occurrenceof the behavioral anomaly in the given cluster layer comprises:identifying a matching node in the SOM for each element of batched inputdata; determining a mean and standard deviation for a distance betweeneach element of input data and the matched node of the SOM, and upondetermining a first one of the elements of input data is matched to anode in the SOM at a distance greater than two standard deviations fromthe mean, flagging the first element of input data as being indicativeof the occurrence of the behavioral anomaly in the given cluster layer.19. The system of claim 18, wherein the operation further comprises:batching, at a given one of the plurality of cluster layers, a set ofnode weight vectors associated with nodes of the SOM; training the ARTnetwork using the batched node weight vectors, wherein evaluating thecluster layers to identify the occurrence of the behavioral anomaly inthe given cluster layer comprises: identifying a matching cluster in ARTnetwork for each node weight vector used to train the ART network;determining a mean and standard deviation for a distance between eachnode weight vector and the matched cluster of the ART network, and upondetermining a first one node weight vectors is matched to a cluster inthe ART network at a distance greater than two standard deviations fromthe mean, flagging the node weight vector as being indicative of theoccurrence of the behavioral anomaly in the given cluster layer.
 20. Thesystem of claim 18, wherein evaluating one or more of the cluster layersto identify an occurrence of a behavioral anomaly in one of the clusterlayers comprises one of (i) determining that the ART network generated anew cluster to model a received set of input data mapped to clusters inthe ART network; and (ii) determining that the ART network mapped areceived set of input data to a cluster in the ART network that has notbeen reinforced with a threshold number of inputs.
 21. The system ofclaim 18, wherein cluster layers subsequent to the first cluster layergenerate clusters from sequences generated by a previous sequence layerand wherein the sequence layers generate sequences of clusters generatedby a previous cluster layer.
 22. The system of claim 18, wherein thefirst cluster layer includes a dorsal side cluster layer and a ventralside cluster layer, and wherein the set of data inputs passed to theventral side cluster layer includes a plurality of numerical kinematicdata vectors characterizing a set of kinematics of the foregroundobjects in the scene and wherein the dorsal side cluster layer includesa plurality of numerical feature data vectors characterizing a set ofmicro features of the foreground objects.
 23. The system of claim 22,wherein the dorsal side cluster layer outputs a symbolic symbol streampassed to a first dorsal side sequence layer and wherein the ventralside cluster layer outputs a second symbolic symbol stream passed to afirst ventral side sequence layer.
 24. The system of claim 22, whereinthe first dorsal side sequence layer and the first ventral side sequencelayer each include a voting experts component configured to induce oneor more segments in the symbolic symbol stream passed to the respectivefirst dorsal side sequence layer and the first ventral side sequencelayer.